Skip to content
Plane vulnerabilities
Newest
-
makeplane plane
CVE-2026-15342
CVE-2026-15342
6.5 Medium
-
makeplane plane
Plane 1.3.1 - Stored XSS in intake issue description_html
CVE-2026-10850
6.9 Medium
-
makeplane plane
Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
CVE-2026-46558
Public exploit
8.3 High
-
makeplane plane
Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics
CVE-2026-40102
6.5 Medium
-
makeplane plane
Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
CVE-2026-39843
7.7 High
-
makeplane plane
Plane Exposes User Email (PII and part of credential) in GET Parameter
CVE-2026-27949
2.0 Low
-
makeplane plane
Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
CVE-2026-39374
6.5 Medium
-
makeplane plane
Plane: Unauthenticated Workspace Member Information Disclosure
CVE-2026-30244
Fix available
7.5 High
-
makeplane plane
Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
CVE-2026-30242
Fix available
8.5 High
-
makeplane plane
Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
CVE-2026-27706
7.7 High
-
makeplane plane
Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch
CVE-2026-27705
4.9 Medium
-
makeplane plane
In plane.io, a Guest User to a Workspace can still be able to see list of members
CVE-2025-69284
4.3 Medium
-
makeplane plane
Plane has insecure permissions in UserSerializer
CVE-2025-48070
3.5 Low
-
makeplane plane
Plane has a Cross-site scripting (XSS) via SVG image upload
CVE-2025-21616
5.4 Medium
-
makeplane plane
Plane allows server side request forgery via /_next/image endpoint
CVE-2024-47830
9.3 Critical
-
makeplane plane
Plane 0.7.1 - Insecure file upload
CVE-2023-30791
7.1 High
-
makeplane plane
Plane v0.7.1 - Unauthorized access to files
CVE-2023-2268
7.1 High